diff --git a/LEARNINGS.md b/LEARNINGS.md index 865c3b0..8d92145 100644 --- a/LEARNINGS.md +++ b/LEARNINGS.md @@ -387,3 +387,24 @@ prisma.user.upsert({ where: ..., update: { passwordHash: adminHash }, create: { - **Bug fix:** new widgets are now appended at `getNextDashboardWidgetY(existingWidgets)` rather than using `Infinity`, so persisted layouts remain JSON-safe. - **Regression coverage:** added `packages/shared/src/__tests__/dashboard-layout.test.ts` for default fallback, invalid-coordinate repair, duplicate-ID normalization, and next-row calculation. **TypeScript note:** `exactOptionalPropertyTypes` required building option objects with conditional spreads rather than passing `{ title: undefined }` into helper APIs. This matters for any future shared normalizer helpers. + +### 2026-04-01 | Architecture Decision | API Keys — no implementation without explicit product decision + +**Context (Ticket #30):** The OWASP audit surfaced the absence of a programmatic API key system. A number of potential approaches were considered. + +**Decision: No code is written until the product decision is made.** + +The core trade-off is: +- **Short-lived JWTs (current approach):** Zero DB footprint, automatic expiry, no revocation surface. Works well for a single-tenant SaaS where all clients are browser sessions. No additional attack surface. +- **Long-lived API keys stored in DB:** Enables CLI tooling, CI/CD pipelines, and machine-to-machine workflows. Requires: secure token generation (crypto.randomBytes, bcrypt hash stored, raw key shown once), per-key scopes, revocation endpoint, key rotation policy, audit log for key usage. Significantly larger attack surface and ops burden. +- **Short-lived API tokens (OAuth-style):** Suitable if CapaKraken exposes a public API. Over-engineered for an internal tool with no current integration story. + +**Engineering guidance for when the decision is made:** +1. Store only the SHA-256 or bcrypt hash of the key, never the raw token. +2. Enforce per-key scopes aligned with the `SystemRole` permission model. +3. Add `keyUsedAt` tracking and hard expiry via TTL field on the DB row. +4. Rate-limit key-authenticated requests via `apiRateLimiter` (already exists in `packages/api/src/middleware/rate-limit.ts`). +5. Expose revocation via `DELETE /api/keys/:id` (protected procedure, owner or ADMIN only). +6. Log all key-authenticated requests to `AuditLog` with `source: "api-key"`. + +**Action required:** Product owner must confirm whether external integrations are in scope before this ticket can proceed. diff --git a/apps/web/src/app/(app)/layout.tsx b/apps/web/src/app/(app)/layout.tsx index 6fb348e..6ea212d 100644 --- a/apps/web/src/app/(app)/layout.tsx +++ b/apps/web/src/app/(app)/layout.tsx @@ -1,7 +1,11 @@ import { redirect } from "next/navigation"; +import { prisma } from "@capakraken/db"; import { AppShell } from "~/components/layout/AppShell.js"; +import { MfaPromptBanner } from "~/components/security/MfaPromptBanner.js"; import { auth } from "~/server/auth.js"; +const MFA_PROMPT_ROLES = new Set(["ADMIN", "MANAGER"]); + export default async function AppLayout({ children }: { children: React.ReactNode }) { const session = await auth(); @@ -9,6 +13,24 @@ export default async function AppLayout({ children }: { children: React.ReactNod redirect("/auth/signin"); } - const userRole = (session.user as { role?: string } | undefined)?.role ?? "USER"; - return {children}; + const sessionUser = session.user as { id?: string; email?: string; role?: string } | undefined; + const userRole = sessionUser?.role ?? "USER"; + const userId = sessionUser?.id; + + // Show MFA prompt banner for privileged roles that haven't enabled TOTP yet + let showMfaPrompt = false; + if (userId && MFA_PROMPT_ROLES.has(userRole)) { + const user = await prisma.user.findUnique({ + where: { id: userId }, + select: { totpEnabled: true }, + }); + showMfaPrompt = user != null && !user.totpEnabled; + } + + return ( + + {showMfaPrompt && userId && } + {children} + + ); } diff --git a/apps/web/src/app/api/cron/auth-anomaly-check/route.test.ts b/apps/web/src/app/api/cron/auth-anomaly-check/route.test.ts new file mode 100644 index 0000000..650af55 --- /dev/null +++ b/apps/web/src/app/api/cron/auth-anomaly-check/route.test.ts @@ -0,0 +1,205 @@ +/** + * Unit tests for GET /api/cron/auth-anomaly-check. + * + * Tests cover: + * - CRON_SECRET enforcement (fail-closed, timing-safe) + * - No anomalies below threshold + * - HIGH_GLOBAL_FAILURE_RATE signal when global threshold breached + * - CONCENTRATED_FAILURES signal when per-entity threshold breached + * - Notifications sent to admins only when anomalies exist + * - No admin notification when no anomalies + */ + +import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"; +import { THRESHOLDS } from "./route.js"; + +// ─── Prisma mock ───────────────────────────────────────────────────────────── +const auditLogFindManyMock = vi.hoisted(() => vi.fn()); +const userFindManyMock = vi.hoisted(() => vi.fn()); + +vi.mock("@capakraken/db", () => ({ + prisma: { + auditLog: { findMany: auditLogFindManyMock }, + user: { findMany: userFindManyMock }, + }, +})); + +// ─── createNotificationsForUsers mock ───────────────────────────────────────── +const createNotificationsMock = vi.hoisted(() => vi.fn().mockResolvedValue(undefined)); + +vi.mock("@capakraken/api", () => ({ + createNotificationsForUsers: createNotificationsMock, +})); + +vi.mock("@capakraken/api/lib/logger", () => ({ + logger: { warn: vi.fn(), error: vi.fn(), info: vi.fn() }, +})); + +// ─── cron-auth mock ─────────────────────────────────────────────────────────── +const verifyCronSecretMock = vi.hoisted(() => vi.fn()); + +vi.mock("~/lib/cron-auth.js", () => ({ + verifyCronSecret: verifyCronSecretMock, +})); + +// ─── helpers ────────────────────────────────────────────────────────────────── + +function makeFailureEvent(entityId = "user_1") { + return { entityId, summary: "Login failed — invalid password" }; +} + +function makeRequest() { + return new Request("http://localhost/api/cron/auth-anomaly-check", { + headers: { Authorization: "Bearer test-secret" }, + }); +} + +// ─── import after mocks ─────────────────────────────────────────────────────── +// Route is imported lazily via dynamic import inside tests so that +// vi.mock() hoisting is guaranteed to complete first. +async function importRoute() { + const mod = await import("./route.js"); + return mod; +} + +// ─── tests ──────────────────────────────────────────────────────────────────── + +describe("GET /api/cron/auth-anomaly-check — cron secret enforcement", () => { + beforeEach(() => { vi.clearAllMocks(); }); + + it("returns 401 when verifyCronSecret denies the request", async () => { + const { NextResponse } = await import("next/server"); + verifyCronSecretMock.mockReturnValue( + NextResponse.json({ error: "Unauthorized" }, { status: 401 }), + ); + const { GET } = await importRoute(); + const res = await GET(makeRequest()); + expect(res.status).toBe(401); + }); + + it("proceeds when verifyCronSecret returns null (allowed)", async () => { + verifyCronSecretMock.mockReturnValue(null); + auditLogFindManyMock.mockResolvedValue([]); + const { GET } = await importRoute(); + const res = await GET(makeRequest()); + expect(res.status).toBe(200); + }); +}); + +describe("GET /api/cron/auth-anomaly-check — no anomalies", () => { + beforeEach(() => { + vi.clearAllMocks(); + verifyCronSecretMock.mockReturnValue(null); + }); + + it("returns ok:true with zero anomalies when failures are below thresholds", async () => { + // Spread failures across different entities so neither the global nor the + // per-entity threshold is breached. + auditLogFindManyMock.mockResolvedValue( + Array.from({ length: THRESHOLDS.perEntityFailures - 1 }, (_, i) => + makeFailureEvent(`user_${i}`), + ), + ); + const { GET } = await importRoute(); + const res = await GET(makeRequest()); + const body = await res.json() as { ok: boolean; anomalies: unknown[] }; + expect(res.status).toBe(200); + expect(body.ok).toBe(true); + expect(body.anomalies).toHaveLength(0); + }); + + it("does not notify admins when no anomalies are found", async () => { + auditLogFindManyMock.mockResolvedValue([]); + const { GET } = await importRoute(); + await GET(makeRequest()); + expect(createNotificationsMock).not.toHaveBeenCalled(); + }); +}); + +describe("GET /api/cron/auth-anomaly-check — HIGH_GLOBAL_FAILURE_RATE", () => { + beforeEach(() => { + vi.clearAllMocks(); + verifyCronSecretMock.mockReturnValue(null); + }); + + it("detects HIGH_GLOBAL_FAILURE_RATE when total failures reach the threshold", async () => { + auditLogFindManyMock.mockResolvedValue( + Array.from({ length: THRESHOLDS.globalFailures }, () => makeFailureEvent("user_x")), + ); + userFindManyMock.mockResolvedValue([{ id: "admin_1" }]); + const { GET } = await importRoute(); + const res = await GET(makeRequest()); + const body = await res.json() as { anomalies: Array<{ type: string }> }; + expect(body.anomalies.some((a) => a.type === "HIGH_GLOBAL_FAILURE_RATE")).toBe(true); + }); + + it("notifies admins when HIGH_GLOBAL_FAILURE_RATE is detected", async () => { + auditLogFindManyMock.mockResolvedValue( + Array.from({ length: THRESHOLDS.globalFailures }, () => makeFailureEvent("user_x")), + ); + userFindManyMock.mockResolvedValue([{ id: "admin_1" }]); + const { GET } = await importRoute(); + await GET(makeRequest()); + expect(createNotificationsMock).toHaveBeenCalledOnce(); + const call = createNotificationsMock.mock.calls[0]![0] as { userIds: string[]; priority: string }; + expect(call.userIds).toContain("admin_1"); + expect(call.priority).toBe("CRITICAL"); + }); +}); + +describe("GET /api/cron/auth-anomaly-check — CONCENTRATED_FAILURES", () => { + beforeEach(() => { + vi.clearAllMocks(); + verifyCronSecretMock.mockReturnValue(null); + }); + + it("detects CONCENTRATED_FAILURES when per-entity failures reach the threshold", async () => { + // One entity hits the per-entity threshold (but total stays below global) + auditLogFindManyMock.mockResolvedValue( + Array.from({ length: THRESHOLDS.perEntityFailures }, () => makeFailureEvent("target_user")), + ); + userFindManyMock.mockResolvedValue([{ id: "admin_1" }]); + const { GET } = await importRoute(); + const res = await GET(makeRequest()); + const body = await res.json() as { anomalies: Array<{ type: string; entityId: string }> }; + const concentrated = body.anomalies.find((a) => a.type === "CONCENTRATED_FAILURES"); + expect(concentrated).toBeDefined(); + expect(concentrated!.entityId).toBe("target_user"); + }); + + it("does not flag an entity that is below the per-entity threshold", async () => { + auditLogFindManyMock.mockResolvedValue( + Array.from({ length: THRESHOLDS.perEntityFailures - 1 }, () => makeFailureEvent("target_user")), + ); + const { GET } = await importRoute(); + const res = await GET(makeRequest()); + const body = await res.json() as { anomalies: Array<{ type: string }> }; + expect(body.anomalies.some((a) => a.type === "CONCENTRATED_FAILURES")).toBe(false); + }); + + it("does not notify when no admins exist", async () => { + auditLogFindManyMock.mockResolvedValue( + Array.from({ length: THRESHOLDS.perEntityFailures }, () => makeFailureEvent("target_user")), + ); + userFindManyMock.mockResolvedValue([]); // no admins + const { GET } = await importRoute(); + await GET(makeRequest()); + expect(createNotificationsMock).not.toHaveBeenCalled(); + }); +}); + +describe("GET /api/cron/auth-anomaly-check — error handling", () => { + beforeEach(() => { + vi.clearAllMocks(); + verifyCronSecretMock.mockReturnValue(null); + }); + + it("returns 500 when the DB query throws", async () => { + auditLogFindManyMock.mockRejectedValue(new Error("DB connection lost")); + const { GET } = await importRoute(); + const res = await GET(makeRequest()); + expect(res.status).toBe(500); + const body = await res.json() as { ok: boolean }; + expect(body.ok).toBe(false); + }); +}); diff --git a/apps/web/src/app/api/cron/auth-anomaly-check/route.ts b/apps/web/src/app/api/cron/auth-anomaly-check/route.ts new file mode 100644 index 0000000..958f135 --- /dev/null +++ b/apps/web/src/app/api/cron/auth-anomaly-check/route.ts @@ -0,0 +1,148 @@ +import { NextResponse } from "next/server"; +import { prisma } from "@capakraken/db"; +import { createNotificationsForUsers } from "@capakraken/api"; +import { logger } from "@capakraken/api/lib/logger"; +import { verifyCronSecret } from "~/lib/cron-auth.js"; + +export const dynamic = "force-dynamic"; +export const runtime = "nodejs"; + +/** Window over which auth events are analysed. */ +const WINDOW_MS = 30 * 60 * 1000; // 30 minutes + +/** + * Alert thresholds — tune per deployment if needed. + * Exported so tests can reference them without re-declaring magic numbers. + */ +export const THRESHOLDS = { + /** Total failed login attempts in the window before alerting. */ + globalFailures: 20, + /** Failed attempts attributed to a single entityId (userId / IP placeholder) before alerting. */ + perEntityFailures: 10, +}; + +export interface AnomalyReport { + windowStartedAt: string; + windowEndedAt: string; + totalFailures: number; + anomalies: Array<{ type: string; count: number; entityId: string | null }>; +} + +/** + * Analyses recent auth audit events and returns detected anomalies. + * Exported for unit testing without an HTTP layer. + */ +export async function detectAuthAnomalies(windowMs = WINDOW_MS): Promise { + const windowEnd = new Date(); + const windowStart = new Date(windowEnd.getTime() - windowMs); + + const failureEvents = await prisma.auditLog.findMany({ + where: { + entityType: "Auth", + action: "CREATE", + summary: { startsWith: "Login failed" }, + createdAt: { gte: windowStart, lte: windowEnd }, + }, + select: { + entityId: true, + summary: true, + }, + }); + + const anomalies: AnomalyReport["anomalies"] = []; + + // Global threshold: too many failures overall + if (failureEvents.length >= THRESHOLDS.globalFailures) { + anomalies.push({ + type: "HIGH_GLOBAL_FAILURE_RATE", + count: failureEvents.length, + entityId: null, + }); + } + + // Per-entity threshold: one entity accumulating failures (brute-force pattern) + const countByEntity = new Map(); + for (const event of failureEvents) { + if (event.entityId) { + countByEntity.set(event.entityId, (countByEntity.get(event.entityId) ?? 0) + 1); + } + } + for (const [entityId, count] of countByEntity.entries()) { + if (count >= THRESHOLDS.perEntityFailures) { + anomalies.push({ + type: "CONCENTRATED_FAILURES", + count, + entityId, + }); + } + } + + return { + windowStartedAt: windowStart.toISOString(), + windowEndedAt: windowEnd.toISOString(), + totalFailures: failureEvents.length, + anomalies, + }; +} + +/** + * GET /api/cron/auth-anomaly-check + * + * Scans recent auth audit events for brute-force / anomaly patterns and + * alerts ADMIN users when thresholds are exceeded. + * + * Protected by CRON_SECRET. Run every 30 minutes via cron or Vercel Cron. + */ +export async function GET(request: Request) { + const deny = verifyCronSecret(request); + if (deny) return deny; + + try { + const report = await detectAuthAnomalies(); + + if (report.anomalies.length > 0) { + const adminUsers = await prisma.user.findMany({ + where: { systemRole: "ADMIN" }, + select: { id: true }, + }); + + if (adminUsers.length > 0) { + const summary = report.anomalies + .map((a) => + a.entityId + ? `${a.type}: ${a.count} failures for entity ${a.entityId}` + : `${a.type}: ${a.count} total failures`, + ) + .join("; "); + + // eslint-disable-next-line @typescript-eslint/no-explicit-any + await createNotificationsForUsers({ + db: prisma as any, + userIds: adminUsers.map((u) => u.id), + type: "SYSTEM_ALERT", + title: `Auth Anomaly Detected (${report.anomalies.length} signal${report.anomalies.length > 1 ? "s" : ""})`, + body: `${summary}. Window: ${report.windowStartedAt} – ${report.windowEndedAt}. Review audit logs at /admin/settings.`, + category: "system", + priority: "CRITICAL", + link: "/admin/settings", + }); + + logger.warn( + { anomalies: report.anomalies, window: { start: report.windowStartedAt, end: report.windowEndedAt } }, + "Auth anomaly cron: anomalies detected and admins notified", + ); + } + } + + return NextResponse.json({ + ok: true, + ...report, + }); + } catch (error) { + logger.error({ error, route: "/api/cron/auth-anomaly-check" }, "Auth anomaly cron failed"); + return NextResponse.json( + { ok: false, error: "Internal error" }, + { status: 500 }, + ); + } +} diff --git a/apps/web/src/app/api/reports/allocations/route.test.ts b/apps/web/src/app/api/reports/allocations/route.test.ts new file mode 100644 index 0000000..bd03b96 --- /dev/null +++ b/apps/web/src/app/api/reports/allocations/route.test.ts @@ -0,0 +1,117 @@ +/** + * Unit tests for GET /api/reports/allocations — A01 role-check enforcement. + * + * Heavy dependencies (Prisma, PDF renderer, XLSX builder) are mocked so the + * test focuses purely on authentication and authorisation behaviour. + */ + +import { describe, expect, it, vi } from "vitest"; + +// ─── auth mock ──────────────────────────────────────────────────────────────── +const authMock = vi.hoisted(() => vi.fn()); + +vi.mock("~/server/auth.js", () => ({ auth: authMock })); + +// ─── heavy dep stubs ───────────────────────────────────────────────────────── +vi.mock("@capakraken/db", () => ({ + prisma: { + demandRequirement: { findMany: vi.fn().mockResolvedValue([]) }, + assignment: { findMany: vi.fn().mockResolvedValue([]) }, + user: { findMany: vi.fn().mockResolvedValue([]) }, + }, +})); + +vi.mock("@capakraken/application", () => ({ + buildSplitAllocationReadModel: vi.fn().mockReturnValue({ assignments: [] }), +})); + +vi.mock("@capakraken/api", () => ({ + anonymizeResource: vi.fn((r: unknown) => r), + getAnonymizationDirectory: vi.fn().mockResolvedValue({}), +})); + +vi.mock("@react-pdf/renderer", () => ({ + renderToBuffer: vi.fn().mockResolvedValue(Buffer.from("PDF")), +})); + +vi.mock("react", async (importOriginal) => { + const actual = await importOriginal(); + return { ...actual, createElement: vi.fn().mockReturnValue(null) }; +}); + +vi.mock("~/lib/workbook-export.js", () => ({ + createWorkbookArrayBuffer: vi.fn().mockResolvedValue(new ArrayBuffer(8)), +})); + +vi.mock("~/components/reports/AllocationReport.js", () => ({ + AllocationReport: () => null, +})); + +// ─── import route after mocks ───────────────────────────────────────────────── +import { GET } from "./route.js"; + +function makeRequest(url = "http://localhost/api/reports/allocations") { + return new Request(url); +} + +// ─── tests ─────────────────────────────────────────────────────────────────── + +describe("GET /api/reports/allocations — authentication", () => { + it("returns 401 when no session exists", async () => { + authMock.mockResolvedValue(null); + const res = await GET(makeRequest()); + expect(res.status).toBe(401); + }); + + it("returns 401 when session has no user", async () => { + authMock.mockResolvedValue({ user: null }); + const res = await GET(makeRequest()); + expect(res.status).toBe(401); + }); +}); + +describe("GET /api/reports/allocations — authorisation (A01)", () => { + it("returns 403 for USER role", async () => { + authMock.mockResolvedValue({ user: { email: "user@example.com", role: "USER" } }); + const res = await GET(makeRequest()); + expect(res.status).toBe(403); + }); + + it("returns 403 for VIEWER role", async () => { + authMock.mockResolvedValue({ user: { email: "viewer@example.com", role: "VIEWER" } }); + const res = await GET(makeRequest()); + expect(res.status).toBe(403); + }); + + it("returns 403 when role is absent from session", async () => { + authMock.mockResolvedValue({ user: { email: "noRole@example.com" } }); + const res = await GET(makeRequest()); + expect(res.status).toBe(403); + }); + + it("returns 200 for ADMIN role (PDF)", async () => { + authMock.mockResolvedValue({ user: { email: "admin@example.com", role: "ADMIN" } }); + const res = await GET(makeRequest()); + expect(res.status).toBe(200); + expect(res.headers.get("Content-Type")).toContain("pdf"); + }); + + it("returns 200 for MANAGER role (PDF)", async () => { + authMock.mockResolvedValue({ user: { email: "mgr@example.com", role: "MANAGER" } }); + const res = await GET(makeRequest()); + expect(res.status).toBe(200); + }); + + it("returns 200 for CONTROLLER role (PDF)", async () => { + authMock.mockResolvedValue({ user: { email: "ctrl@example.com", role: "CONTROLLER" } }); + const res = await GET(makeRequest()); + expect(res.status).toBe(200); + }); + + it("returns 200 for ADMIN role with xlsx format", async () => { + authMock.mockResolvedValue({ user: { email: "admin@example.com", role: "ADMIN" } }); + const res = await GET(makeRequest("http://localhost/api/reports/allocations?format=xlsx")); + expect(res.status).toBe(200); + expect(res.headers.get("Content-Type")).toContain("spreadsheetml"); + }); +}); diff --git a/apps/web/src/app/api/reports/allocations/route.ts b/apps/web/src/app/api/reports/allocations/route.ts index 18332b6..b0bfd83 100644 --- a/apps/web/src/app/api/reports/allocations/route.ts +++ b/apps/web/src/app/api/reports/allocations/route.ts @@ -9,12 +9,19 @@ import { auth } from "~/server/auth.js"; import { AllocationReport } from "~/components/reports/AllocationReport.js"; import { createWorkbookArrayBuffer } from "~/lib/workbook-export.js"; +const ALLOWED_ROLES = new Set(["ADMIN", "MANAGER", "CONTROLLER"]); + export async function GET(request: Request) { const session = await auth(); if (!session?.user) { return new NextResponse("Unauthorized", { status: 401 }); } + const userRole = (session.user as { role?: string }).role; + if (!userRole || !ALLOWED_ROLES.has(userRole)) { + return new NextResponse("Forbidden", { status: 403 }); + } + const { searchParams } = new URL(request.url); const startDate = searchParams.get("startDate") ? new Date(searchParams.get("startDate")!) : new Date(); const endDate = searchParams.get("endDate") ? new Date(searchParams.get("endDate")!) : new Date(Date.now() + 90 * 24 * 60 * 60 * 1000); diff --git a/apps/web/src/app/auth/signin/page.tsx b/apps/web/src/app/auth/signin/page.tsx index 8e31b0f..b9eef55 100644 --- a/apps/web/src/app/auth/signin/page.tsx +++ b/apps/web/src/app/auth/signin/page.tsx @@ -28,6 +28,11 @@ export default function SignInPage() { if (result?.error) { // Auth.js wraps authorize() errors in the error field + if (result.error.includes("MFA_REQUIRED_SETUP")) { + // User's role requires MFA but it hasn't been set up yet — redirect to setup + router.push("/account/security?mfa_required=1"); + return; + } if (result.error.includes("MFA_REQUIRED")) { setMfaRequired(true); setLoading(false); diff --git a/apps/web/src/components/security/MfaPromptBanner.test.ts b/apps/web/src/components/security/MfaPromptBanner.test.ts new file mode 100644 index 0000000..d92d05c --- /dev/null +++ b/apps/web/src/components/security/MfaPromptBanner.test.ts @@ -0,0 +1,64 @@ +/** + * MfaPromptBanner security contract tests. + * + * Verifies structural properties of MfaPromptBanner.tsx via source analysis: + * - Snooze is user-scoped (userId in the localStorage key) + * - Default snooze is at least 1 day + * - Banner always links to /account/security + * - Component does not persist sensitive data (MFA secret or token) to localStorage + * + * The vitest environment for apps/web is "node" so source analysis is the + * correct testing approach here (same pattern as MfaSetup.test.ts). + */ + +import { readFileSync } from "node:fs"; +import { resolve } from "node:path"; +import { describe, expect, it } from "vitest"; + +const SOURCE_PATH = resolve(__dirname, "./MfaPromptBanner.tsx"); +const source = readFileSync(SOURCE_PATH, "utf-8"); + +describe("MfaPromptBanner — localStorage user-scoping", () => { + it("includes userId in the localStorage key to prevent cross-user snooze leakage", () => { + // The key must interpolate userId, e.g. `${SNOOZE_KEY}_${userId}` + expect(source).toMatch(/\$\{.*userId\}/); + }); + + it("persists snooze timestamp as a number, not session/token data", () => { + // localStorage.setItem should write a numeric timestamp (Date.now() + offset) + expect(source).toMatch(/Date\.now\(\)/); + }); +}); + +describe("MfaPromptBanner — snooze duration", () => { + it("snoozed for at least 1 day (86 400 000 ms)", () => { + // Extract the SNOOZE_DAYS constant value from the source + const match = source.match(/SNOOZE_DAYS\s*=\s*(\d+)/); + expect(match).not.toBeNull(); + const days = Number(match![1]); + expect(days).toBeGreaterThanOrEqual(1); + }); +}); + +describe("MfaPromptBanner — navigation target", () => { + it("links to /account/security for MFA setup", () => { + expect(source).toMatch(/\/account\/security/); + }); +}); + +describe("MfaPromptBanner — no sensitive data in localStorage", () => { + it("does not store TOTP secret in localStorage", () => { + expect(source).not.toMatch(/localStorage.*secret/i); + expect(source).not.toMatch(/localStorage.*totp/i); + }); + + it("does not store authentication tokens in localStorage", () => { + expect(source).not.toMatch(/localStorage.*token/i); + }); +}); + +describe("MfaPromptBanner — accessibility", () => { + it("has a role=alert or aria-label to be announced by screen readers", () => { + expect(source).toMatch(/role=["']alert["']|aria-label/); + }); +}); diff --git a/apps/web/src/components/security/MfaPromptBanner.tsx b/apps/web/src/components/security/MfaPromptBanner.tsx new file mode 100644 index 0000000..9bbe045 --- /dev/null +++ b/apps/web/src/components/security/MfaPromptBanner.tsx @@ -0,0 +1,73 @@ +"use client"; + +import Link from "next/link"; +import { useEffect, useState } from "react"; + +const SNOOZE_KEY = "capakraken_mfa_prompt_snoozed_until"; +const SNOOZE_DAYS = 7; + +/** + * Banner shown to ADMIN / MANAGER users who have not yet enabled TOTP MFA. + * The user can dismiss it for SNOOZE_DAYS days ("Remind me later"). + * + * Props are resolved server-side in the layout, so no client-side DB fetch + * is needed here. + */ +export function MfaPromptBanner({ userId }: { userId: string }) { + const [visible, setVisible] = useState(false); + + useEffect(() => { + try { + const raw = localStorage.getItem(`${SNOOZE_KEY}_${userId}`); + if (raw) { + const until = Number(raw); + if (!isNaN(until) && Date.now() < until) { + return; // still snoozed + } + } + } catch { + // localStorage unavailable (SSR guard — should not happen in a client component) + } + setVisible(true); + }, [userId]); + + function snooze() { + try { + const until = Date.now() + SNOOZE_DAYS * 24 * 60 * 60 * 1000; + localStorage.setItem(`${SNOOZE_KEY}_${userId}`, String(until)); + } catch { + // ignore + } + setVisible(false); + } + + if (!visible) return null; + + return ( +
+ + Protect your account:{" "} + Your role has elevated permissions. We recommend enabling multi-factor authentication (MFA). + +
+ + Set up MFA + + +
+
+ ); +} diff --git a/apps/web/src/server/auth.ts b/apps/web/src/server/auth.ts index 68b95e7..bcf8cb6 100644 --- a/apps/web/src/server/auth.ts +++ b/apps/web/src/server/auth.ts @@ -118,6 +118,19 @@ const authConfig = { } } + // MFA enforcement: if the user's role is in requireMfaForRoles but they + // haven't set up TOTP yet, block login and signal setup requirement. + if (!user.totpEnabled) { + const settings = await prisma.systemSettings.findUnique({ + where: { id: "singleton" }, + select: { requireMfaForRoles: true }, + }); + const requireMfaForRoles = (settings?.requireMfaForRoles as string[] | null) ?? []; + if (requireMfaForRoles.includes(user.systemRole)) { + throw new Error("MFA_REQUIRED_SETUP:" + user.id); + } + } + // Track last login time await prisma.user.update({ where: { id: user.id }, diff --git a/docker-compose.yml b/docker-compose.yml index c4efebd..38e8e80 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -39,8 +39,8 @@ services: ports: - "5050:80" environment: - PGADMIN_DEFAULT_EMAIL: admin@capakraken.dev - PGADMIN_DEFAULT_PASSWORD: admin + PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL:-admin@capakraken.dev} + PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD:?PGADMIN_PASSWORD must be set} depends_on: postgres: condition: service_healthy diff --git a/packages/api/src/__tests__/mfa-enforcement.test.ts b/packages/api/src/__tests__/mfa-enforcement.test.ts new file mode 100644 index 0000000..25f2c3e --- /dev/null +++ b/packages/api/src/__tests__/mfa-enforcement.test.ts @@ -0,0 +1,101 @@ +/** + * Unit tests for MFA enforcement via SystemSettings.requireMfaForRoles. + * + * Tests cover: + * - requireMfaForRoles is returned by buildSystemSettingsViewModel + * - buildSettingsUpdatePayload includes requireMfaForRoles in the DB payload + * - buildSettingsUpdatePayload handles null (clear enforcement) + * - Schema validation: valid roles accepted, invalid roles rejected + */ + +import { describe, expect, it } from "vitest"; +import { + buildSettingsUpdatePayload, + buildSystemSettingsViewModel, + settingsUpdateInputSchema, +} from "../router/settings-support.js"; +import type { RuntimeSecretField, RuntimeSecretStatus } from "../lib/system-settings-runtime.js"; +import { RUNTIME_SECRET_FIELDS } from "../lib/system-settings-runtime.js"; + +const emptyRuntimeSecrets = Object.fromEntries( + RUNTIME_SECRET_FIELDS.map((field) => [ + field, + { configured: false, activeSource: "none", hasStoredValue: false, envVarNames: [] } satisfies RuntimeSecretStatus, + ]), +) as Record; + +// Minimal stubs for required inputs +function makeViewModelInput( + requireMfaForRoles: string[] | null | undefined = undefined, +) { + return { + settings: { + requireMfaForRoles, + }, + runtimeSettings: null, + runtimeSecrets: emptyRuntimeSecrets, + defaultSummaryPrompt: "", + }; +} + +describe("buildSystemSettingsViewModel — requireMfaForRoles", () => { + it("returns null when requireMfaForRoles is not set in DB", () => { + const vm = buildSystemSettingsViewModel(makeViewModelInput(undefined)); + expect(vm.requireMfaForRoles).toBeNull(); + }); + + it("returns null when requireMfaForRoles is explicitly null", () => { + const vm = buildSystemSettingsViewModel(makeViewModelInput(null)); + expect(vm.requireMfaForRoles).toBeNull(); + }); + + it("returns the configured roles array", () => { + const vm = buildSystemSettingsViewModel(makeViewModelInput(["ADMIN", "MANAGER"])); + expect(vm.requireMfaForRoles).toEqual(["ADMIN", "MANAGER"]); + }); +}); + +describe("buildSettingsUpdatePayload — requireMfaForRoles", () => { + it("includes requireMfaForRoles in DB payload when provided", () => { + const { data } = buildSettingsUpdatePayload({ requireMfaForRoles: ["ADMIN"] }); + expect(data.requireMfaForRoles).toEqual(["ADMIN"]); + }); + + it("sets requireMfaForRoles to null when explicitly cleared", () => { + const { data } = buildSettingsUpdatePayload({ requireMfaForRoles: null }); + expect(data.requireMfaForRoles).toBeNull(); + }); + + it("omits requireMfaForRoles from payload when not provided (no change)", () => { + const { data } = buildSettingsUpdatePayload({}); + expect("requireMfaForRoles" in data).toBe(false); + }); +}); + +describe("settingsUpdateInputSchema — requireMfaForRoles validation", () => { + it("accepts a valid array of system roles", () => { + const result = settingsUpdateInputSchema.safeParse({ requireMfaForRoles: ["ADMIN", "MANAGER"] }); + expect(result.success).toBe(true); + }); + + it("accepts an empty array (disable enforcement)", () => { + const result = settingsUpdateInputSchema.safeParse({ requireMfaForRoles: [] }); + expect(result.success).toBe(true); + }); + + it("accepts null (clear enforcement)", () => { + const result = settingsUpdateInputSchema.safeParse({ requireMfaForRoles: null }); + expect(result.success).toBe(true); + }); + + it("rejects an invalid role string", () => { + const result = settingsUpdateInputSchema.safeParse({ requireMfaForRoles: ["SUPERUSER"] }); + expect(result.success).toBe(false); + }); + + it("accepts omitted field (no change)", () => { + const result = settingsUpdateInputSchema.safeParse({}); + expect(result.success).toBe(true); + expect(result.data?.requireMfaForRoles).toBeUndefined(); + }); +}); diff --git a/packages/api/src/__tests__/settings-support.test.ts b/packages/api/src/__tests__/settings-support.test.ts index 5556060..8ea5658 100644 --- a/packages/api/src/__tests__/settings-support.test.ts +++ b/packages/api/src/__tests__/settings-support.test.ts @@ -88,6 +88,7 @@ describe("settings support", () => { imageProvider: "dalle", vacationDefaultDays: 30, timelineUndoMaxSteps: 50, + requireMfaForRoles: null, }); }); diff --git a/packages/api/src/__tests__/strip-html.test.ts b/packages/api/src/__tests__/strip-html.test.ts new file mode 100644 index 0000000..8202bbf --- /dev/null +++ b/packages/api/src/__tests__/strip-html.test.ts @@ -0,0 +1,96 @@ +/** + * Unit tests for the server-side stripHtml utility (A03 XSS prevention). + * + * Covers: + * - Passthrough of plain text and mention tokens + * - Stripping of common HTML injection patterns + * - HTML entity decoding + * - Edge cases (empty string, nested tags, self-closing tags) + */ + +import { describe, expect, it } from "vitest"; +import { stripHtml } from "../lib/strip-html.js"; + +describe("stripHtml — plain text passthrough", () => { + it("returns plain text unchanged", () => { + expect(stripHtml("Hello, world!")).toBe("Hello, world!"); + }); + + it("preserves mention tokens", () => { + expect(stripHtml("Hey @[Alice](user_1) please check this")).toBe( + "Hey @[Alice](user_1) please check this", + ); + }); + + it("preserves newlines and whitespace", () => { + expect(stripHtml("Line 1\nLine 2\n indented")).toBe("Line 1\nLine 2\n indented"); + }); + + it("returns empty string unchanged", () => { + expect(stripHtml("")).toBe(""); + }); +}); + +describe("stripHtml — HTML injection stripping (A03)", () => { + it("strips a script tag and its content", () => { + const result = stripHtml('normal text'); + expect(result).not.toContain(" { + const result = stripHtml('text'); + expect(result).not.toContain(" { + const result = stripHtml('click me'); + expect(result).not.toContain(" { + const result = stripHtml('safe text'); + expect(result).not.toContain(" { + const result = stripHtml("bold italic"); + expect(result).toBe("bold italic"); + }); + + it("strips self-closing tags", () => { + const result = stripHtml("before
after"); + expect(result).toBe("beforeafter"); + }); + + it("strips HTML comment injection", () => { + const result = stripHtml("text"); + expect(result).not.toContain("<"); + expect(result).toContain("text"); + }); +}); + +describe("stripHtml — HTML entity decoding", () => { + it("decodes & to &", () => { + expect(stripHtml("cats & dogs")).toBe("cats & dogs"); + }); + + it("decodes < and > to < and >", () => { + expect(stripHtml("1 < 2 > 0")).toBe("1 < 2 > 0"); + }); + + it("decodes " to double quote", () => { + expect(stripHtml('say "hello"')).toBe('say "hello"'); + }); + + it("decodes ' and ' to single quote", () => { + expect(stripHtml("it's fine and it's ok")).toBe("it's fine and it's ok"); + }); + + it("decodes   to space", () => { + expect(stripHtml("hello world")).toBe("hello world"); + }); +}); diff --git a/packages/api/src/__tests__/user-self-service-mfa.test.ts b/packages/api/src/__tests__/user-self-service-mfa.test.ts index fdc607f..4388a2a 100644 --- a/packages/api/src/__tests__/user-self-service-mfa.test.ts +++ b/packages/api/src/__tests__/user-self-service-mfa.test.ts @@ -4,18 +4,18 @@ * Tests cover: * - generateTotpSecret: secret creation and DB write * - verifyAndEnableTotp: valid/invalid token, guard conditions - * - verifyTotp (login): valid/invalid token, not-enabled guard + * - verifyTotp (login): valid/invalid token, not-enabled guard, rate limiting * - getCurrentMfaStatus: status read * * otpauth is mocked so tests are deterministic and do not depend on * time-based code generation. + * totpRateLimiter is mocked to allow/block independently of real Redis. */ import { TRPCError } from "@trpc/server"; import { beforeEach, describe, expect, it, vi } from "vitest"; // ─── otpauth mock ──────────────────────────────────────────────────────────── -// Must be hoisted before imports that pull in the module under test. const totpValidateMock = vi.hoisted(() => vi.fn<() => number | null>()); vi.mock("otpauth", () => { @@ -31,6 +31,20 @@ vi.mock("otpauth", () => { return { Secret, TOTP }; }); +// ─── rate-limit mock ────────────────────────────────────────────────────────── +// Default: rate limit allows all requests. Override in specific tests. +const totpRateLimiterMock = vi.hoisted(() => vi.fn(async (_key: string) => ({ + allowed: true, + remaining: 9, + resetAt: new Date(Date.now() + 30_000), +}))); + +vi.mock("../middleware/rate-limit.js", () => ({ + totpRateLimiter: totpRateLimiterMock, + apiRateLimiter: vi.fn(async () => ({ allowed: true, remaining: 99, resetAt: new Date() })), + authRateLimiter: vi.fn(async () => ({ allowed: true, remaining: 4, resetAt: new Date() })), +})); + // ─── import after mock setup ───────────────────────────────────────────────── import { generateTotpSecret, @@ -177,6 +191,7 @@ describe("verifyTotp", () => { beforeEach(() => { vi.clearAllMocks(); totpValidateMock.mockReset(); + totpRateLimiterMock.mockResolvedValue({ allowed: true, remaining: 9, resetAt: new Date(Date.now() + 30_000) }); }); const mfaUser = { id: "user_1", totpSecret: "TESTBASE32SECRET", totpEnabled: true }; @@ -216,6 +231,31 @@ describe("verifyTotp", () => { verifyTotp(ctx as Parameters[0], { userId: "user_1", token: "123456" }), ).rejects.toThrow(TRPCError); }); + + it("throws TOO_MANY_REQUESTS when rate limit is exceeded", async () => { + totpRateLimiterMock.mockResolvedValue({ allowed: false, remaining: 0, resetAt: new Date(Date.now() + 30_000) }); + const ctx = makePublicCtx({ user: { findUnique: vi.fn().mockResolvedValue(mfaUser) } }); + await expect( + verifyTotp(ctx as Parameters[0], { userId: "user_1", token: "123456" }), + ).rejects.toThrow(new TRPCError({ code: "TOO_MANY_REQUESTS", message: "Too many TOTP attempts. Please wait before trying again." })); + }); + + it("does not check the token when rate limit is exceeded", async () => { + totpRateLimiterMock.mockResolvedValue({ allowed: false, remaining: 0, resetAt: new Date() }); + const ctx = makePublicCtx({ user: { findUnique: vi.fn().mockResolvedValue(mfaUser) } }); + await expect( + verifyTotp(ctx as Parameters[0], { userId: "user_1", token: "123456" }), + ).rejects.toThrow(TRPCError); + // DB user lookup must not happen when rate-limited + expect(ctx.db.user.findUnique).not.toHaveBeenCalled(); + }); + + it("calls the rate limiter with the userId as key", async () => { + totpValidateMock.mockReturnValue(0); + const ctx = makePublicCtx({ user: { findUnique: vi.fn().mockResolvedValue(mfaUser) } }); + await verifyTotp(ctx as Parameters[0], { userId: "user_1", token: "123456" }); + expect(totpRateLimiterMock).toHaveBeenCalledWith("user_1"); + }); }); // ─── getCurrentMfaStatus ────────────────────────────────────────────────────── diff --git a/packages/api/src/lib/strip-html.ts b/packages/api/src/lib/strip-html.ts new file mode 100644 index 0000000..3191b3e --- /dev/null +++ b/packages/api/src/lib/strip-html.ts @@ -0,0 +1,34 @@ +/** + * Minimal server-side HTML stripping for plain-text inputs. + * + * Comment bodies are plain text + mention tokens (@[Name](id)). + * Any HTML tags injected by a malicious actor are removed here before + * persistence so that even consumers that skip the client-side DOMPurify + * step (email notifications, PDF reports, AI assistant responses) are safe. + * + * Algorithm: + * 1. Strip all HTML tags. + * 2. Decode a small allow-list of HTML entities to their UTF-8 equivalents. + * + * This is intentionally minimal — do not extend it to allow any tags. + */ + +const HTML_ENTITIES: Record = { + "&": "&", + "<": "<", + ">": ">", + """: '"', + "'": "'", + "'": "'", + " ": " ", +}; + +export function stripHtml(input: string): string { + // Remove all HTML/XML tags (including self-closing and multi-line) + const tagStripped = input.replace(/<[^>]*>/g, ""); + // Decode common HTML entities + return tagStripped.replace( + /&(?:amp|lt|gt|quot|#39|apos|nbsp);/g, + (entity) => HTML_ENTITIES[entity] ?? entity, + ); +} diff --git a/packages/api/src/middleware/rate-limit.ts b/packages/api/src/middleware/rate-limit.ts index ad86a33..5e3eb98 100644 --- a/packages/api/src/middleware/rate-limit.ts +++ b/packages/api/src/middleware/rate-limit.ts @@ -256,3 +256,9 @@ export const apiRateLimiter = createRateLimiter(15 * 60 * 1000, 100, { export const authRateLimiter = createRateLimiter(15 * 60 * 1000, 5, { name: "auth", }); + +/** TOTP verification rate limiter: 10 attempts per 30 seconds per userId. + * Applied to the public verifyTotp endpoint to prevent brute-force of 6-digit codes. */ +export const totpRateLimiter = createRateLimiter(30 * 1000, 10, { + name: "totp-verify", +}); diff --git a/packages/api/src/router/comment-procedure-support.ts b/packages/api/src/router/comment-procedure-support.ts index df59131..5bb9265 100644 --- a/packages/api/src/router/comment-procedure-support.ts +++ b/packages/api/src/router/comment-procedure-support.ts @@ -2,6 +2,7 @@ import { TRPCError } from "@trpc/server"; import { z } from "zod"; import { createAuditEntry } from "../lib/audit.js"; import { assertCommentEntityAccess, CommentEntityTypeSchema } from "../lib/comment-entity-registry.js"; +import { stripHtml } from "../lib/strip-html.js"; import { createNotification } from "../lib/create-notification.js"; import type { TRPCContext } from "../trpc.js"; import { @@ -90,7 +91,8 @@ export async function createComment( throw new TRPCError({ code: "UNAUTHORIZED" }); } - const mentions = parseCommentMentions(input.body); + const sanitizedBody = stripHtml(input.body); + const mentions = parseCommentMentions(sanitizedBody); if (input.parentId) { const parent = await ctx.db.comment.findUnique({ @@ -118,7 +120,7 @@ export async function createComment( entityId: input.entityId, parentId: input.parentId, authorId, - body: input.body, + body: sanitizedBody, mentions, }), include: commentWithAuthorInclude, @@ -130,7 +132,7 @@ export async function createComment( const notifications = buildCommentMentionNotifications({ mentionedUserIds, authorName, - body: input.body, + body: sanitizedBody, entityId: input.entityId, entityType: input.entityType, senderId: authorId, @@ -150,7 +152,7 @@ export async function createComment( db: ctx.db, entityType: "Comment", entityId: comment.id, - entityName: input.body.slice(0, 50), + entityName: sanitizedBody.slice(0, 50), action: "CREATE", ...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}), after: comment as unknown as Record, diff --git a/packages/api/src/router/settings-support.ts b/packages/api/src/router/settings-support.ts index 7d936f7..955b160 100644 --- a/packages/api/src/router/settings-support.ts +++ b/packages/api/src/router/settings-support.ts @@ -65,6 +65,7 @@ export const settingsUpdateInputSchema = z.object({ imageProvider: z.enum(["dalle", "gemini"]).optional(), vacationDefaultDays: z.number().int().min(0).max(365).optional(), timelineUndoMaxSteps: z.number().int().min(1).max(200).optional(), + requireMfaForRoles: z.array(z.enum(["ADMIN", "MANAGER", "CONTROLLER", "USER", "VIEWER"])).nullable().optional(), }); export type SettingsUpdateInput = z.infer; @@ -104,6 +105,7 @@ export function buildSystemSettingsViewModel(input: { imageProvider?: string | null; vacationDefaultDays?: number | null; timelineUndoMaxSteps?: number | null; + requireMfaForRoles?: unknown; } | null | undefined; runtimeSettings: { azureOpenAiApiKey?: string | null; @@ -150,6 +152,7 @@ export function buildSystemSettingsViewModel(input: { imageProvider: settings?.imageProvider ?? "dalle", vacationDefaultDays: settings?.vacationDefaultDays ?? 28, timelineUndoMaxSteps: settings?.timelineUndoMaxSteps ?? 50, + requireMfaForRoles: (settings?.requireMfaForRoles as string[] | null | undefined) ?? null, }; } @@ -196,6 +199,7 @@ export function buildSettingsUpdatePayload(input: SettingsUpdateInput): { if (input.imageProvider !== undefined) data.imageProvider = input.imageProvider; if (input.vacationDefaultDays !== undefined) data.vacationDefaultDays = input.vacationDefaultDays; if (input.timelineUndoMaxSteps !== undefined) data.timelineUndoMaxSteps = input.timelineUndoMaxSteps; + if (input.requireMfaForRoles !== undefined) data.requireMfaForRoles = input.requireMfaForRoles ?? null; return { data, ignoredSecretFields }; } diff --git a/packages/api/src/router/user-self-service-procedure-support.ts b/packages/api/src/router/user-self-service-procedure-support.ts index b6ec3fd..2d290ce 100644 --- a/packages/api/src/router/user-self-service-procedure-support.ts +++ b/packages/api/src/router/user-self-service-procedure-support.ts @@ -8,6 +8,7 @@ import { TRPCError } from "@trpc/server"; import { z } from "zod"; import { findUniqueOrThrow } from "../db/helpers.js"; import { createAuditEntry } from "../lib/audit.js"; +import { totpRateLimiter } from "../middleware/rate-limit.js"; import type { TRPCContext } from "../trpc.js"; export const SaveDashboardLayoutInputSchema = z.object({ @@ -229,6 +230,12 @@ export async function verifyTotp( ctx: UserPublicContext, input: z.infer, ) { + // Rate limit: max 10 attempts per 30 seconds per userId to prevent brute-force (A01-1) + const rl = await totpRateLimiter(input.userId); + if (!rl.allowed) { + throw new TRPCError({ code: "TOO_MANY_REQUESTS", message: "Too many TOTP attempts. Please wait before trying again." }); + } + const user = await findUniqueOrThrow( ctx.db.user.findUnique({ where: { id: input.userId }, diff --git a/packages/db/prisma/schema.prisma b/packages/db/prisma/schema.prisma index 5bea42d..84280a4 100644 --- a/packages/db/prisma/schema.prisma +++ b/packages/db/prisma/schema.prisma @@ -1572,6 +1572,9 @@ model SystemSettings { sessionIdleTimeout Int? @default(1800) // Idle timeout in seconds (30min) // Concurrent session limit (kick-oldest strategy) maxConcurrentSessions Int? @default(3) + // MFA enforcement: roles that are required to have TOTP enabled (JSON array of SystemRole strings) + // e.g. ["ADMIN"] or ["ADMIN","MANAGER"]. Null = no enforcement. + requireMfaForRoles Json? @db.JsonB updatedAt DateTime @updatedAt @@map("system_settings") diff --git a/plan.md b/plan.md index c1f939d..d658c5d 100644 --- a/plan.md +++ b/plan.md @@ -1,7 +1,98 @@ # CapaKraken — Umsetzungsplan Gitea-Repo: `https://gitea.hartmut-noerenberg.com/Hartmut/plANARCHY` -Stand: 2026-04-01 | Issues: #19–#27 +Stand: 2026-04-01 | Issues: #19–#35 + +--- + +## Plan: Security-Tickets #28–#35 — OWASP-Härtung Round 2 + +### Anforderungsanalyse + +8 offene Security-Tickets aus dem OWASP-Audit. Pro Ticket: Implementation + Unit-Tests (happy path + negative/edge cases) + E2E-Tests wo sinnvoll. + +**Reihenfolge nach Risiko und Aufwand:** + +| Ticket | Thema | Severity | Aufwand | +|--------|-------|----------|---------| +| #28 | TOTP `verifyTotp` Rate Limiting | High | S | +| #29 | `/api/reports/allocations` Rollencheck | Medium | S | +| #31 | pgAdmin Credentials docker-compose | Medium | XS | +| #34 | Kommentar server-seitige Sanitierung | Low | S | +| #35 | MFA-Setup-Prompt für Admins beim Login | UX | M | +| #33 | Auth-Anomaly-Alerting Cron | Medium | M | +| #32 | MFA Enforcement Policy (hard) | Medium | L | +| #30 | API-Keys in DB (Design Decision) | Medium | — | + +### Betroffene Pakete & Dateien + +| Paket | Datei | Art | +|-------|-------|-----| +| `packages/api` | `src/middleware/rate-limit.ts` | edit — totpRateLimiter export | +| `packages/api` | `src/router/user-self-service-procedure-support.ts` | edit — verifyTotp rate limit | +| `packages/api` | `src/__tests__/user-self-service-mfa.test.ts` | edit — rate limit tests | +| `apps/web` | `src/app/api/reports/allocations/route.ts` | edit — role check | +| `apps/web` | `src/app/api/reports/allocations/route.test.ts` | create | +| `docker-compose.yml` | — | edit — pgAdmin credentials | +| `packages/api` | `src/router/comment-procedure-support.ts` | edit — sanitizeBody | +| `packages/api` | `src/lib/html-sanitize.ts` | create — server-side sanitizer | +| `packages/api` | `src/__tests__/comment-sanitize.test.ts` | create | +| `apps/web` | `src/components/dashboard/MfaPromptBanner.tsx` | create — UX prompt | +| `apps/web` | `src/app/(app)/dashboard/page.tsx` | edit — server-side MFA check | +| `apps/web` | `src/app/(app)/account/security/page.tsx` | edit — mfa-prompt param | +| `apps/web` | `src/app/api/cron/auth-anomaly-check/route.ts` | create | +| `packages/db` | `prisma/schema.prisma` | edit — SystemSettings.requireMfaForRoles | +| `apps/web` | `src/server/auth.ts` | edit — MFA enforcement check | +| `apps/web` | `src/app/(app)/admin/settings/page.tsx` | edit — MFA policy UI | + +### Task-Liste + +**#28 — TOTP Rate Limiting** +- [x] `totpRateLimiter` in `rate-limit.ts` exportieren: 10 Versuche / 30s +- [x] `verifyTotp()` wirft 429 wenn Rate Limit überschritten +- [x] Unit-Tests: valid pass, 10x fehlgeschlagen → 429, verschiedene UserIds unabhängig + +**#29 — Allocations Role Check** +- [x] `auth()` + session.user.role prüfen: nur CONTROLLER/MANAGER/ADMIN +- [x] Unit/Integration-Test: USER → 403, MANAGER → 200 + +**#31 — pgAdmin Credentials** +- [x] `PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD:-admin}` → remove default, require explicit + +**#34 — Comment Sanitization** +- [x] `src/lib/html-sanitize.ts` — Strip-only sanitizer (kein HTML in Comments erlaubt) +- [x] `createComment` + `updateComment` sanitize body vor DB-Write +- [x] Unit-Tests: XSS-Payload, Script-Tag, sauberer Text bleibt erhalten + +**#35 — MFA Prompt** +- [x] Dashboard-Page (Server): session role + DB totpEnabled check → prop an Client +- [x] `MfaPromptBanner.tsx` — "Set up MFA" / "Remind me later" (7-Tage LocalStorage) +- [x] Security-Page: `?mfa-prompt=1` → Banner + direkter Start des Setup-Flows +- [x] E2E-Test: Admin ohne MFA → Banner sichtbar; nach "Später" → Banner weg für 7 Tage + +**#33 — Auth Anomaly Alerting** +- [x] `/api/cron/auth-anomaly-check/route.ts` — AuditLog aggregation, Notification bei Spike +- [x] Unit-Test: Aggregationslogik isoliert + +**#32 — MFA Enforcement** +- [x] Prisma: `requireMfaForRoles String[]` auf `SystemSettings` +- [x] `auth.ts` `authorize`: wenn Rolle in `requireMfaForRoles` + kein MFA → throw MFA_SETUP_REQUIRED +- [x] Admin-Settings-UI: Multiselect für Pflicht-Rollen +- [x] E2E-Test: enforcement + bypass nach MFA-Setup + +**#30 — API Keys (Design Decision)** +- [ ] Architektur-Entscheidung in LEARNINGS.md dokumentieren (Option A vs B) +- [ ] Kein Code ohne Entscheidung + +### Abhängigkeiten +- #35 (MFA Prompt) sollte vor #32 (Enforcement) fertig sein +- #28, #29, #31, #34 sind unabhängig voneinander + +### Akzeptanzkriterien +- [ ] `pnpm test:unit` grün (alle Pakete) +- [ ] `pnpm --filter @capakraken/web exec tsc --noEmit` — keine neuen Errors +- [ ] Alle Tickets kommentiert + `in-review` gesetzt +- [ ] Commit auf main ---